WafAuditAction.cs

using System.Collections.Generic;
using System.Threading.Tasks;
using System.Xml;
using Waher.Content.Xml.Attributes;
using Waher.Networking.HTTP.Interfaces;
using Waher.Security.LoginMonitor;
 
namespace Waher.Security.WAF.Model.Actions
{
    public abstract class WafAuditAction : WafActionWithTags
    {
        protected readonly StringAttribute message;
 
        protected readonly StringAttribute userName;
 
        protected readonly StringAttribute protocol;
 
        public WafAuditAction()
            : base()
        {
        }
 
        public WafAuditAction(XmlElement Xml, WafAction Parent, WebApplicationFirewall Document)
            : base(Xml, Parent, Document)
        {
            this.message = new StringAttribute(Xml, "message");
            this.protocol = new StringAttribute(Xml, "protocol");
            this.userName = new StringAttribute(Xml, "userName");
        }
 
        public override async Task<WafResult?> Review(ProcessingState State)
        {
            string Message = await this.message.EvaluateAsync(State.Variables, string.Empty);
            string Protocol = await this.protocol.EvaluateAsync(State.Variables, "HTTP");
            string UserName = await this.userName.EvaluateAsync(State.Variables, string.Empty);
            KeyValuePair<string, object>[] Tags = await this.EvaluateTags(State);
 
            LoginAuditor.Fail(Message, UserName, State.Request.RemoteEndPoint, Protocol, Tags);
 
            return null;
        }
    }
}